Add clarification on security releases

Author: dondonz

blog/2023-03-14-release-policy.md

@@ -12,7 +12,7 @@ Going forward, we plan to have 4 releases every year, one per quarter. We will a
 For example: our next release 20.1 will be in early April 2023, and this will be a feature and bugfix release without breaking changes. Therefore, we’re going to retain Java 8 in the April release. Our subsequent release will be in early July 2023 and will contain breaking changes, including upgrading to Java 11.
 
 ## Security backports
-We will backport critical bugfixes and security fixes for versions dating back 18 months (or roughly 6 versions). These fixes will be backported depending on severity and demand.
+We will backport critical bugfixes and security fixes for versions dating back 18 months (or roughly 6 versions). These fixes will be backported depending on severity and demand. As security fixes are time sensitive, we will release them on demand instead of waiting for the next quarterly release date.
 
 ## Bugfix backports
 We will backport important bug fixes at most 12 months (or roughly 4 versions). These fixes will be backported depending on the severity of the bug and demand.